Analysis

  • max time kernel
    51s
  • max time network
    57s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 18:39

General

  • Target

    08b98cea751df2f1a0b93c1026c98c62_JaffaCakes118.exe

  • Size

    706KB

  • MD5

    08b98cea751df2f1a0b93c1026c98c62

  • SHA1

    059e9e6615c562af98d4505f12d3ae1f08b6ef67

  • SHA256

    5f5e4235a44db94afdd2f9643e14f36d69f3854040270a78125529070d83e098

  • SHA512

    6e5a248a0a84f3d44ee5a494e138313ccbd69a3cdabef0e7b23302df9164fc82a6d66c06d4e1042e48376ef79a72e3170dfe28e65317cac0de01ab5a49982dde

  • SSDEEP

    12288:tLIqdYi+c5m3UtUV11g+V6WRoTG0WBSVXF3Z4mxxzDqVTVOCy:pIXc5m3UCN9V6qoT/W0XQmXaVTzy

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08b98cea751df2f1a0b93c1026c98c62_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\08b98cea751df2f1a0b93c1026c98c62_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2008_S~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2008_S~1.EXE
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3652
      • C:\program files\internet explorer\IEXPLORE.EXE
        "C:\program files\internet explorer\IEXPLORE.EXE"
        3⤵
          PID:3528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2008_S~1.EXE

      Filesize

      301KB

      MD5

      5bd1216746054bd6eac0ab50c6c68b5e

      SHA1

      44836f2e7932970b9ec06652905becd2ad3cc038

      SHA256

      e1357cc2990eba4af60c70ea3e2f4921869ff1aa4db9fb056efdc2309ca17505

      SHA512

      4c031e8dc0994dbb41d728df86d1b71d8cfaa95578e6820ff4917528c263b3670d0c871a34db7d141ddab635831d7d00ac6ea04fec5a5eaea18db9b0f3d8ec53

    • memory/2516-0-0x0000000001000000-0x000000000116B000-memory.dmp

      Filesize

      1.4MB

    • memory/2516-1-0x00000000007B0000-0x0000000000804000-memory.dmp

      Filesize

      336KB

    • memory/2516-2-0x0000000000830000-0x0000000000831000-memory.dmp

      Filesize

      4KB

    • memory/2516-86-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-85-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-3-0x0000000000810000-0x0000000000811000-memory.dmp

      Filesize

      4KB

    • memory/2516-84-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-83-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-82-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-81-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-80-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-79-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-78-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-77-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-76-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-75-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-74-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-73-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-72-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-71-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-70-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-69-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-68-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-67-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-66-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-65-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-64-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-63-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-62-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-61-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-60-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-59-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-58-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-57-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-56-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-55-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-54-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-53-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-52-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-51-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-50-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-49-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-48-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-47-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-46-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-45-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-44-0x0000000000F40000-0x0000000000F41000-memory.dmp

      Filesize

      4KB

    • memory/2516-43-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

      Filesize

      4KB

    • memory/2516-42-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

      Filesize

      4KB

    • memory/2516-41-0x0000000000F10000-0x0000000000F11000-memory.dmp

      Filesize

      4KB

    • memory/2516-40-0x0000000000F30000-0x0000000000F31000-memory.dmp

      Filesize

      4KB

    • memory/2516-39-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-38-0x0000000000D40000-0x0000000000D41000-memory.dmp

      Filesize

      4KB

    • memory/2516-37-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

      Filesize

      4KB

    • memory/2516-36-0x0000000000E90000-0x0000000000E91000-memory.dmp

      Filesize

      4KB

    • memory/2516-35-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

      Filesize

      4KB

    • memory/2516-34-0x0000000000D20000-0x0000000000D21000-memory.dmp

      Filesize

      4KB

    • memory/2516-33-0x0000000000D30000-0x0000000000D31000-memory.dmp

      Filesize

      4KB

    • memory/2516-32-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

      Filesize

      4KB

    • memory/2516-31-0x0000000000D50000-0x0000000000D51000-memory.dmp

      Filesize

      4KB

    • memory/2516-30-0x0000000000E80000-0x0000000000E81000-memory.dmp

      Filesize

      4KB

    • memory/2516-29-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-28-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-27-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-26-0x00000000033A0000-0x00000000033A1000-memory.dmp

      Filesize

      4KB

    • memory/2516-25-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-24-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-23-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-22-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-21-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-20-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-19-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-18-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-17-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-16-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-15-0x0000000000D00000-0x0000000000D01000-memory.dmp

      Filesize

      4KB

    • memory/2516-14-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-13-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-12-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-11-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-10-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-9-0x00000000033B0000-0x00000000033B1000-memory.dmp

      Filesize

      4KB

    • memory/2516-8-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

      Filesize

      4KB

    • memory/2516-7-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

      Filesize

      4KB

    • memory/2516-6-0x0000000000780000-0x0000000000781000-memory.dmp

      Filesize

      4KB

    • memory/2516-5-0x0000000000790000-0x0000000000791000-memory.dmp

      Filesize

      4KB

    • memory/2516-4-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

      Filesize

      4KB

    • memory/2516-96-0x00000000007B0000-0x0000000000804000-memory.dmp

      Filesize

      336KB

    • memory/2516-95-0x0000000001000000-0x000000000116B000-memory.dmp

      Filesize

      1.4MB

    • memory/3652-93-0x0000000000400000-0x00000000004C1000-memory.dmp

      Filesize

      772KB